nerdexam
GIAC

GSEC · Question #261

On an NTFS file system, what will happen when a conflict exists between Allow and Deny permissions?

The correct answer is C. Deny permission will take precedence over the Allow permission. In NTFS, Deny permissions always take precedence over Allow permissions, regardless of group membership or other factors.

Operating System Security

Question

On an NTFS file system, what will happen when a conflict exists between Allow and Deny permissions?

Options

  • AThe resolution depends on the groups that the user belongs to.
  • BAllow permission will take precedence over the Deny permission.
  • CDeny permission will take precedence over the Allow permission.
  • DThe resolution depends on the user's machine rights.

How the community answered

(52 responses)
  • A
    13% (7)
  • B
    4% (2)
  • C
    77% (40)
  • D
    6% (3)

Why each option

In NTFS, Deny permissions always take precedence over Allow permissions, regardless of group membership or other factors.

AThe resolution depends on the groups that the user belongs to.

Group membership does not alter the outcome of an Allow vs. Deny conflict - a Deny permission overrides Allow regardless of which group grants the Allow.

BAllow permission will take precedence over the Deny permission.

Allow does not take precedence over Deny in NTFS; the rule is the reverse, as Deny is always the stronger permission.

CDeny permission will take precedence over the Allow permission.Correct

NTFS enforces a strict permission precedence rule where an explicit Deny always overrides any Allow permission on the same resource. This applies whether the permissions are directly assigned or inherited through group membership. This design ensures that restricting access to a resource is always the dominant control, preventing unintended access grants.

DThe resolution depends on the user's machine rights.

Local machine rights do not influence NTFS permission conflict resolution - Deny overrides Allow at the file system level independent of machine-level settings.

Concept tested: NTFS permission conflict resolution - Deny overrides Allow

Source: https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-principals

Topics

#NTFS#file permissions#ACL#Deny precedence

Community Discussion

No community discussion yet for this question.

Full GSEC Practice